The vulnerability is a classic SQL Injection in the registration script of the Complaint Management System 2.0. The lack of input validation on fields such as fullname, email, and contactno allows an attacker to inject arbitrary SQL statements into database queries. This flaw could enable the attacker to read, modify, or delete application data, leading to loss of confidentiality or integrity of stored information.

Customers are affected by phpgurukul Complaint Management System 2.0 as identified by the CPE cpe:2.3:a:phpgurukul:complaint_management_system:2.0. The system is vulnerable whenever the registration page is reachable. No vendor patch is listed, so internal remediation or upgraded releases must be sought.

The CVSS score of 7.5 categorizes this as a high severity flaw. However, the EPSS score is less than 1%, implying a very low probability of exploitation in the wild. The flaw is not listed in CISA's KEV catalog, indicating the threat level is currently low. Based on the description, the likely attack vector is remote via HTTP requests to the vulnerable registration endpoint, and the attack can be executed without special access privileges.